demobite 1.7.5 → 1.7.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "demobite",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "description": "The DemoBites agentic recorder — you prompt, it films a real browser, and DemoBites turns the take into an editable demo bite.",
   "bin": {
     "demobite": "launcher/index.mjs"

package/skill/SKILL.md

@@ -95,7 +95,7 @@ The camera browser uses a persistent profile at `.recorder/profile`. Signed in s
 
 When a page you need shows a login wall (login form, auth redirect, checkpoint page):
 
-1. Open a HEADED Playwright window on that profile at the login page and tell the human: "Sign in in the window I opened. I will wait." Poll for a signed in signal (URL leaves the login path, or a session cookie appears), then close the window. The session now lives in the profile.
+1. Run `node scripts/signin.mjs <login url>` — THE ONE WAY to open that window (founder 2026-10-14). It launches the camera's own browser (the real Chrome, the recorder profile, the anti-automation flag), tells the human "Sign in in the window that opened. I will wait.", waits until the URL leaves the login page, and closes the window; the session now lives in the profile. NEVER launch a sign-in window of your own: a bare Playwright launch declares itself an automation browser (`navigator.webdriver`), and an app's bot check (Cloudflare Turnstile, reCAPTCHA…) refuses the sign-in — the take is lost there and the customer with it. If the script reports that the bot check refused even this window, say so plainly and stop; do not try other browsers.
 2. NEVER type, read, store, or ask for credentials. Not the password, not a 2FA code, nothing. The human signs in with their own hands.
 3. Do this only when a wall actually appears. Do not preemptively ask for logins.
 

package/skill/scripts/signin.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Phase 2: the target app's sign-in, by the human's own hands, in the
+// recorder's own browser window (founder 2026-10-14: a sign-in window the
+// agent improvised launched Chrome WITHOUT the camera's anti-automation flag,
+// and the app's bot check — Cloudflare Turnstile on app.demobites.com —
+// refused the sign-in: "Verification failed". Any customer whose app checks
+// for bots at the login would lose the take there, and we would never see
+// them again). This script is the ONE way to open that window: the same
+// launch as record.mjs — the real Google Chrome binary, the persistent
+// recorder profile, `--disable-blink-features=AutomationControlled` — so the
+// page sees the genuine product, not a bare automation browser.
+//
+//   node scripts/signin.mjs <login url> [--timeout <ms>] [--probe]
+//
+// It opens the window, tells the human to sign in, and waits until the URL
+// leaves the login page (or a session cookie appears), then closes the
+// window: the session now lives in `.recorder/profile` and the camera reuses
+// it. Never types, reads, stores or asks for credentials. `--probe` only
+// loads the page, reports whether the bot check passed, and exits — the
+// recorder's own health check, no human needed.
+import path from "node:path";
+import { chromium } from "playwright";
+
+const argv = process.argv.slice(2);
+const url = argv.find((a) => !a.startsWith("--"));
+if (!url) { console.error("Usage: node scripts/signin.mjs <login url> [--timeout <ms>] [--probe]"); process.exit(2); }
+const probe = argv.includes("--probe");
+const timeoutMs = Number(argv[argv.indexOf("--timeout") + 1]) || 10 * 60 * 1000;
+const profileDir = process.env.RECORDER_PROFILE || path.resolve(process.cwd(), ".recorder", "profile");
+
+// The camera's launch (record.mjs), minus the video.
+const launchOpts = {
+  headless: false,
+  viewport: { width: 1440, height: 900 },
+  deviceScaleFactor: 1,
+  args: ["--force-color-profile=srgb", "--disable-blink-features=AutomationControlled"],
+  ignoreDefaultArgs: ["--enable-automation"],
+};
+let ctx;
+try {
+  ctx = await chromium.launchPersistentContext(profileDir, { ...launchOpts, channel: "chrome" });
+} catch (e) {
+  console.error(`Real Chrome failed to launch (${String(e.message).split("\n")[0]}); falling back to bundled Chromium.`);
+  ctx = await chromium.launchPersistentContext(profileDir, launchOpts);
+}
+const page = ctx.pages()[0] ?? (await ctx.newPage());
+await page.goto(url, { waitUntil: "domcontentloaded" });
+const startPath = new URL(page.url()).pathname;
+
+const botCheck = async () => {
+  // Cloudflare Turnstile leaves a token in this input when it passes; the
+  // page shows "Verification failed" when it does not. Other walls: unknown.
+  try {
+    return await page.evaluate(() => {
+      const input = document.querySelector('input[name="cf-turnstile-response"]');
+      const text = document.body.innerText || "";
+      if (input && input.value) return "passed";
+      if (/verification failed/i.test(text)) return "failed";
+      return input ? "pending" : "none";
+    });
+  } catch { return "unknown"; }
+};
+
+if (probe) {
+  let state = "pending";
+  for (let i = 0; i < 20 && (state === "pending" || state === "unknown"); i++) { await page.waitForTimeout(1000); state = await botCheck(); }
+  const webdriver = await page.evaluate(() => navigator.webdriver).catch(() => "?");
+  console.log(`probe: bot check ${state} · navigator.webdriver=${webdriver} · ${page.url()}`);
+  await ctx.close();
+  process.exit(state === "failed" ? 1 : 0);
+}
+
+console.log("Sign in in the window that opened. I will wait — nothing is typed or read for you.");
+const started = Date.now();
+let lastCheck = "none";
+while (Date.now() - started < timeoutMs) {
+  await page.waitForTimeout(1000);
+  let here;
+  try { here = new URL(page.url()); } catch { continue; }
+  if (here.pathname !== startPath && !/sign-?in|log-?in|auth|sso|oauth|callback/i.test(here.pathname)) {
+    console.log(`Signed in (now at ${here.pathname}). The session is saved in the recorder profile.`);
+    await ctx.close();
+    process.exit(0);
+  }
+  const state = await botCheck();
+  if (state === "failed" && lastCheck !== "failed") {
+    console.error("The page's bot check refused this window (\"Verification failed\"). Reload the page in this window once; if it fails again, this app cannot be signed into from an automated browser — tell the human plainly and stop.");
+  }
+  lastCheck = state;
+}
+console.error("No sign-in happened within the wait. Closing the window; the take did not start.");
+await ctx.close();
+process.exit(1);